the-web-application-hackers-handbook

Chapter 17 n Attacking Application Architecture 661
apache
Because the malicious customer’s commands are executing as the Apache
user, it is likely that this will allow access to the scripts and data belonging to
other customers of the shared hosting service.
This kind of threat also exists in the context of an ASP-managed shared application.
Although the core application functionality is owned and updated by
the ASP, individual customers typically can modify this functionality in certain
defined ways. A malicious customer may introduce subtle backdoors into code
that he controls, enabling him to compromise the shared application and gain
access to other customers’ data.
TIP Backdoor scripts can be created in most web scripting languages. For
more examples of scripts in other languages, see http://net-square.com/
papers/one_way/one_way.html#4.0.
Attacks Between Vulnerable Applications
Even if all customers in a shared environment are benign, and upload only
legitimate scripts that are validated by the environment’s owner, attacks between
applications will, of course, be possible if vulnerabilities unwittingly exist within
the applications of individual customers. In this situation, one vulnerability
within a single application may enable a malicious user to compromise both
that application and all others hosted within the shared environment. Many
types of common vulnerability fall into this category. For example:
n A SQL injection flaw in one application may enable an attacker to perform
arbitrary SQL queries on the shared database. If database access is
inadequately segregated between different customers, an attacker may
be able to read and modify the data used by all applications.
n A path traversal vulnerability in one application may enable an attacker
to read or write arbitrary files anywhere on the server filesystem, including
those belonging to other applications.
n A command injection flaw in one application may enable an attacker to
compromise the server and, therefore, the other applications hosted on
it, in the same way as described for a malicious customer.
Attacks Between ASP Application Components
The possible attacks described previously may all arise in the context of a
shared ASP application. Because customers typically can perform their own